sandboxed python plugins

Question

Hi

I'm planning to write a pluggable application in python (+qt4). However I have great concerns about security. The plugins should be powerful enough as to do whatever they like within the application (and as a further constraint there will be a signing process and a warning for the user when using such a plugin), but interacting with the environment (filesystem, other processes, networking, etc) should be done by the plugins only through some python code I will write.

Is there any safe and easy way to achieve it, beside having to do static code analysis on the code of the plugins prior to installing them?

Answer 1

In short: No.

Explanation: For years, the Python gurus try to build a sandbox for Python. The problem with the sandbox is that you need a couple of things to do any IO (i.e. being able to transfer data at all between your sandbox and the app). They didn't find an automatic, pythonic way to do it. Either, you can't exchange data with the plugin or introspection would then allow to walk the object tree in the app -> access to everything you like.

Imagine your idea: The plugin calls some python code which you write. This probably means to call a method or function. That means you must give me a valid method or function object. From the method or function object, I can get your module object. From your module, I can get all the symbols (i.e. the imports). From there, I can do everything your module can do (at least).

See this article for some pointers.